@dashai/cli 0.24.0 → 0.26.0

package/dist/bin.js

@@ -112,6 +112,12 @@ function resolveApiUrl() {
   if (cfg?.apiUrl) return cfg.apiUrl.replace(/\/+$/, "");
   return DEFAULT_API_URL;
 }
+function resolveExplicitApiUrl() {
+  const fromEnv = process.env.DASHWISE_API_URL?.trim();
+  if (fromEnv) return fromEnv.replace(/\/+$/, "");
+  const cfg = safeReadConfig();
+  return cfg?.apiUrl ? cfg.apiUrl.replace(/\/+$/, "") : null;
+}
 function readSavedToken() {
   const cfg = safeReadConfig();
   return cfg?.token ?? null;
@@ -822,6 +828,74 @@ var init_connect_status = __esm({
     SETUP_SETTINGS_PATH = "Modules \u2192 Installed modules \u2192 Technical \u2192 Data connections";
   }
 });
+function declaredSecretNames(manifest) {
+  const names = [];
+  for (const s of manifest?.runtime?.secrets ?? []) {
+    if (typeof s?.key === "string" && SECRET_KEY.test(s.key) && !names.includes(s.key)) {
+      names.push(s.key);
+    }
+  }
+  return names;
+}
+function envLocalSetNames(projectRoot) {
+  const set = /* @__PURE__ */ new Set();
+  const path = join(projectRoot, ".env.local");
+  if (!existsSync(path)) return set;
+  for (const line of readFileSync(path, "utf-8").split(/\r?\n/)) {
+    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!m) continue;
+    const value = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+    if (value.length > 0) set.add(m[1]);
+  }
+  return set;
+}
+function missingSecretNames(declared, env, envLocal2) {
+  return declared.filter((k) => !(env[k] !== void 0 && env[k] !== "") && !envLocal2.has(k));
+}
+function secretsBannerLine(declared, missing) {
+  if (declared.length === 0) return null;
+  if (missing.length === 0) return `${declared.length} declared, all set`;
+  return `${declared.length} declared, ${missing.length} missing: ${missing.join(", ")} (add ${missing.length === 1 ? "it" : "them"} to .env.local)`;
+}
+function withSecretLines(content, names) {
+  const mentioned = (k) => new RegExp(`^\\s*#?\\s*(?:export\\s+)?${k}\\s*=`, "m").test(content);
+  const add = names.filter((k) => !mentioned(k));
+  if (add.length === 0) return content;
+  const hasHeader = content.includes(ENV_LOCAL_SECRETS_HEADER[0]);
+  const block = [...hasHeader ? [] : ENV_LOCAL_SECRETS_HEADER, ...add.map((k) => `# ${k}=`)].join("\n");
+  const base = content.length === 0 || content.endsWith("\n") ? content : `${content}
+`;
+  return `${base}${base.length > 0 && !hasHeader ? "\n" : ""}${block}
+`;
+}
+function syncEnvLocalSecretLines(projectRoot, names) {
+  if (names.length === 0) return [];
+  const path = join(projectRoot, ".env.local");
+  const before = existsSync(path) ? readFileSync(path, "utf-8") : "";
+  const after = withSecretLines(before, names);
+  if (after === before) return [];
+  writeFileSync(path, after, "utf-8");
+  return names.filter((k) => !new RegExp(`^\\s*#?\\s*(?:export\\s+)?${k}\\s*=`, "m").test(before));
+}
+function reportSecretLines(added) {
+  if (added.length === 0) return;
+  info(
+    `Added ${added.map((k) => code(`# ${k}=`)).join(", ")} to ${code(".env.local")}: set dev values there. Hosted modules do not receive declared secrets yet.`
+  );
+}
+var SECRET_KEY, ENV_LOCAL_SECRETS_HEADER;
+var init_declared_secrets = __esm({
+  "src/lib/declared-secrets.ts"() {
+    init_output();
+    SECRET_KEY = /^[A-Z][A-Z0-9_]*$/;
+    ENV_LOCAL_SECRETS_HEADER = [
+      "# Declared runtime secrets (module.json runtime.secrets[]). Set a dev value",
+      "# after the `=` and remove the `#`; `dashwise dev` names any that are missing.",
+      "# Hosted modules do not receive declared secrets yet (platform item U1);",
+      "# locally `dashwise dev` runs `next dev`, which reads them from this file."
+    ];
+  }
+});
 function manifestPath(dir) {
   return join(resolve(dir ?? process.cwd()), "module.json");
 }
@@ -1166,6 +1240,12 @@ async function devCommand(options) {
   (Ensure you're logged into the right backend: ${code(`dashwise login --api-url ${apiUrl}`)}.)`
     );
   }
+  {
+    const declared = declaredSecretNames(readManifest(projectRoot));
+    const missing = missingSecretNames(declared, childEnv, envLocalSetNames(projectRoot));
+    const line = secretsBannerLine(declared, missing);
+    if (line !== null) (missing.length > 0 ? warn : info)(`  ${dim("secrets")}     ${line}`);
+  }
   info("");
   if (moduleEntry !== null && manifestSlug !== void 0) {
     await reportConnectStatus({
@@ -1406,13 +1486,13 @@ async function resolveDevPort(requested) {
 }
 async function isPortFree(port) {
   const { createServer } = await import('net');
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const server = createServer();
     server.once("error", () => {
-      resolve15(false);
+      resolve16(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve15(true));
+      server.close(() => resolve16(true));
     });
     server.listen(port, "0.0.0.0");
   });
@@ -1480,6 +1560,7 @@ var init_dev = __esm({
     init_api_client();
     init_connect_status();
     init_config();
+    init_declared_secrets();
     init_manifest_io();
     init_manifest_poll();
     init_output();
@@ -1634,7 +1715,7 @@ var init_simple = __esm({
             typescript: "^5.5.0"
           },
           engines: {
-            node: "22.x"
+            node: "22.x || 24.x"
           }
         },
         "node_modules/@dashai/sdk": {
@@ -2679,7 +2760,7 @@ var init_custom = __esm({
             typescript: "^5.5.0"
           },
           engines: {
-            node: "22.x"
+            node: "22.x || 24.x"
           }
         },
         "node_modules/@alloc/quick-lru": {
@@ -10017,9 +10098,10 @@ function packageJson(opts) {
       version: "0.0.1",
       private: true,
       type: "module",
-      engines: { node: "22.x" },
+      engines: { node: NODE_ENGINES },
       scripts: {
-        dev: "dashwise module dev",
+        dev: "dashwise dev",
+        "dev:watch": "dashwise module dev",
         "dev:next": "next dev",
         "dashwise:generate": "dashwise module generate",
         typecheck: "tsc --noEmit",
@@ -10235,7 +10317,7 @@ function appPageTsx(opts) {
           Module slug: <code>${escapeHtml(opts.slug)}</code>
         </p>
         <p style={{ marginTop: 24, color: '#64748b', fontSize: 14 }}>
-          Run <code>dashwise module dev</code> to start the watch loop.
+          Run <code>npm run dev</code> to start the app and the watch loop.
           <br />
           Edit <code>module.json</code> to add tables; regenerated types
           land in <code>@dashai/generated</code>.
@@ -10269,7 +10351,7 @@ debugger to Next), use the legacy two-terminal flow:
 
 \`\`\`bash
 dashwise module generate    # produces node_modules/@dashai/generated/
-dashwise module dev         # watch module.json + auto-regenerate
+npm run dev:watch           # watch module.json + auto-regenerate
 npm run dev:next            # plain Next.js dev server (in another terminal)
 \`\`\`
 
@@ -10314,7 +10396,7 @@ debugger to Next), use the legacy two-terminal flow:
 
 \`\`\`bash
 dashwise module generate    # produces node_modules/@dashai/generated/
-dashwise module dev         # watch + regen on module.json save (terminal 1)
+npm run dev:watch           # watch + regen on module.json save (terminal 1)
 npm run dev:next            # next dev on :3000                  (terminal 2)
 \`\`\`
 
@@ -11119,9 +11201,10 @@ function packageJsonCustom(opts) {
       version: "0.0.1",
       private: true,
       type: "module",
-      engines: { node: "22.x" },
+      engines: { node: NODE_ENGINES },
       scripts: {
-        dev: "dashwise module dev",
+        dev: "dashwise dev",
+        "dev:watch": "dashwise module dev",
         "dev:next": "next dev",
         "dashwise:generate": "dashwise module generate",
         typecheck: "tsc --noEmit",
@@ -12208,7 +12291,7 @@ in this Dashwise module. Read this before making changes.
 
 Every table declares exactly one primary field (the row's name everywhere in Dashwise).
 
-${opts.cloudReady === false ? "" : cloudAgentInstructions()}
+${opts.cloudReady === false ? "" : cloudAgentInstructions() + "\n" + claudeCloudNote(opts.apiUrl)}
 ## What this module is
 
 A Dashwise ${isCustom ? "**custom Next.js** module (full app runtime, machine-class)" : "**hand-authored simple** module (isolate runtime)"} authored against \`@dashai/sdk\`.
@@ -12587,9 +12670,14 @@ dashwise module destroy-dev-install  # tear down when done (cleans backend + aut
 - **No untyped \`any\`.** The generated SDK gives you types \u2014 use
   them. If you need an escape hatch, add a \`@ts-expect-error\` with
   a comment explaining why.
-- **No secrets in code or env files.** Use \`runtime.secrets[]\` in
-  \`module.json\`; values are encrypted at rest and resolved at
-  runtime.
+- **No secrets in code or committed env files.** Declare each one in
+  \`runtime.secrets[]\` in \`module.json\` (by name; values never go in the
+  repo). Hosted modules do not receive declared secrets yet (platform item
+  U1): until that lands, a hosted module cannot read them. Locally, put dev
+  values in the gitignored \`.env.local\` (\`dashwise init\` and
+  \`dashwise module generate\` add a commented \`# KEY=\` line per declared
+  secret); \`dashwise dev\` runs \`next dev\`, which loads them, and names
+  any that are missing.
 
 ## Pointers
 
@@ -12745,15 +12833,145 @@ primary_region = "iad"
 `;
 }
 function cloudAgentInstructions() {
-  return `## Cloud workflow
+  return `## Default way of working
+
+These are defaults. When the person you work for says otherwise (in the chat,
+or in their own \`CLAUDE.md\` / \`AGENTS.md\`), follow them instead.
+
+- Assume the person is not a developer. Before and after each step, say in one
+  or two plain sentences what you are doing and why, for example "I'm saving
+  your changes so Dashwise can see them." When a term like branch or pull
+  request is unavoidable, explain it in a few words.
+- You handle git. Get the finished work onto the repository's default branch
+  (usually \`main\`) yourself, so the person, Dashwise and the next agent all
+  see the latest version. The person needs no git, branch or pull request
+  knowledge:
+  - Working locally on the person's computer: commit on the default branch and push it.
+  - Working in the cloud (Codex cloud, Claude Code on the web): if your tool
+    lets you push to the default branch or merge your own pull request, do it
+    once the checks pass. If it only lets you push a branch, push it and tell the
+    person in plain words that the changes are saved and that Release in
+    Dashwise includes them. Don't ask them to merge anything.
+- Never force-push and never rewrite the default branch's history.
+- The person only confirms Release and Take live in Dashwise. When the work is
+  pushed, tell them it is ready: in Dashwise open the module, click Release,
+  then Take live.
+
+## Cloud workflow
 
 - Read \`module.json\`, the task and \`spec.md\` first. Preserve module identity and permission checks.
-- Use Node 22 in the provider environment (\`.nvmrc\` / \`.node-version\`). From the repository root run \`bash scripts/cloud-setup.sh\`.
+- Use Node 22 or 24 (\`.nvmrc\` prefers 22; Codex's default 24 works too). From the repository root run \`bash scripts/cloud-setup.sh\`.
 - After edits run \`npm run typecheck\`, \`npm test\`, \`npm run build\`, then \`npm run smoke:production\`. Add behavior tests for your changes. A dev server does not prove production readiness.
 - Update \`spec.md\` for behavior changes and \`agent-log.md\` in the same commit. Read \`CLAUDE.md\` for SDK, authorization and UI conventions.
-- Work on one branch and push it. Report the pushed SHA and checks, including failures. No user merge is required for Dashwise to receive the branch.
-- Never print, persist or commit secrets. Repository code delivery needs no Dashwise token. Do not log in or access company data for setup or checks.
+- \`npm run smoke:production\` starts the built app on a local loopback port. If a cloud sandbox refuses that port, rerun the command with the network permission; never skip the check.
+- Report what you changed, the pushed SHA and the checks you ran, including failures, in plain words.
+- Never print, persist or commit secrets. Repository code delivery needs no Dashwise token. Do not log in or access company data for setup or checks; see "Dashwise login" for full development.
 - Never automatically release, publish, deploy or take an installation live. Release and Live require an explicit human action.
+- Even when the person says you may release, you can't do it for them: tell them in one sentence where to click (in Dashwise open the module, click Release, then Take live). Never ask for a \`dashwise login\` or a token just to release.
+
+## If you can't see the repository
+
+Connecting GitHub in the AI tool is not enough for a private repository. Tell
+the person, in plain words, to also install the tool's GitHub app on the GitHub
+organisation that owns this repository and give it access to this repository
+(an organisation owner may have to approve it), then start the task again:
+
+- Claude: the Claude GitHub app, https://github.com/apps/claude
+- Codex: the ChatGPT Codex Connector, https://github.com/apps/chatgpt-codex-connector
+
+## Dashwise login (only for full development)
+
+The checks (\`npm run typecheck\`, \`npm test\`, \`npm run build\`,
+\`npm run smoke:production\`) need no login. Full Dashwise development does:
+\`npm run dev\` (\`dashwise dev\`: the app plus the watcher), \`dashwise module
+generate\` and the schema commands. When the task needs them:
+
+- If \`dashwise\` is not installed, run \`npm install -g @dashai/cli@latest\`.
+- Ask the person once, in plain words, for example: "To run your module
+  against Dashwise I need to sign in as you. I'll show you a code and a link;
+  open the link and approve." Then run \`dashwise login --no-prompt\` and show
+  them the code and link it prints. The login acts with the person's own rights.
+- Keep the login outside the repository. In the cloud, run CLI commands with
+  \`XDG_CONFIG_HOME=/tmp/dashwise-config\` so the saved login lands in
+  \`/tmp\`, never in the checkout.
+- Never write a token into a script, a file in the repository, a commit, an
+  environment setup script or snapshot, or a log.
+- In the cloud, run CLI commands with \`NODE_USE_ENV_PROXY=1\` so the CLI
+  uses the environment's network proxy (newer CLI versions do this on their own).
+- A cloud environment forgets the login when it restarts; ask again only when
+  a command reports that the login is missing.
+`;
+}
+function companyApiHost(apiUrl) {
+  if (!apiUrl) return null;
+  try {
+    const host = new URL(apiUrl).host;
+    return host in HOSTED_API_HOSTS ? host : null;
+  } catch {
+    return null;
+  }
+}
+function apiHostLine(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  return host ? `\`${host}\` (this company's Dashwise API; the company uses Dashwise at ${HOSTED_API_HOSTS[host]})` : "the company's Dashwise API host: `api.dashwise.net` if the person opens Dashwise at app.dashwise.net, `api.dashwise.dev` if at app.dashwise.dev. If you can't tell, ask them which address they use";
+}
+function codexEnvironmentInstructions(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  const apiUrlValue = host ? `https://${host}` : "https://<the company API host above>";
+  return `## Codex cloud environment
+
+When the person asks you to set up the Codex cloud environment for this
+repository, use exactly these settings. Show each one to the person and say in
+one sentence what it is for.
+
+| Setting | Value |
+|---|---|
+| Node.js | 22 or 24 (24 is Codex's default and works; \`.nvmrc\` prefers 22) |
+| Setup script | \`if [ -f scripts/cloud-setup.sh ]; then bash scripts/cloud-setup.sh; else echo "No Dashwise template yet, setup skipped"; fi\` |
+| Agent internet access | On: keep the "package managers" preset and add only the company's Dashwise API host (below) |
+| Environment variables | \`DASHWISE_API_URL=${apiUrlValue}\`, \`NODE_USE_ENV_PROXY=1\` |
+| Secrets | none |
+
+Set the network access before you start the setup, so the first run can
+already install packages. The preset covers npm and GitHub; the one added
+domain is:
+
+- ${apiHostLine(apiUrl)}
+
+The module and the CLI talk to the company's Dashwise API. Do not add other
+Dashwise hosts. If the environment offers no preset, allow exactly
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} plus that host.
+
+The setup script checks Node 22 or 24 and installs the exact dependencies with
+\`npm ci\`. The guard lets a first run pass while the repository holds only a
+README.
+
+Never add secrets: no \`dwk_\` module key, no \`dwc_\` CLI token and no password,
+and never put a \`dashwise login\` into the setup script. Delivering code needs
+none of them; for full development see "Dashwise login".
+
+To check the environment, run \`npm run typecheck\`, \`npm test\`,
+\`npm run build\` and \`npm run smoke:production\`. If one fails because of a
+setting, fix the setting; otherwise report the failure in plain words.
+
+If the repository has no \`package.json\` yet (only a README), skip these
+checks: the setup script already skipped installing, and the first task adds
+the template. Tell the person the settings are ready.
+
+When the checks pass, or were skipped for a README-only repository, tell the
+person: "The environment works. Click Publish to save it for your next tasks."
+Publishing is their click.
+`;
+}
+function claudeCloudNote(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  return `## Claude cloud
+
+Claude Code on the web has no environment setup chat. It reads this repository
+and \`CLAUDE.md\`, and \`.claude/settings.json\` runs \`scripts/cloud-setup.sh\`
+when a cloud session starts. Node 22 or 24 both work. If
+the environment has a network setting, allow the same domains as for Codex:
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} and ${host ? `\`${host}\`` : "the company's Dashwise API host (`api.dashwise.net` for app.dashwise.net, `api.dashwise.dev` for app.dashwise.dev)"}. No secrets.
 `;
 }
 function agentsMd(opts) {
@@ -12761,7 +12979,7 @@ function agentsMd(opts) {
 
 Every table declares exactly one primary field (the row's name everywhere in Dashwise).
 
-` + cloudAgentInstructions();
+` + cloudAgentInstructions() + "\n" + codexEnvironmentInstructions(opts.apiUrl) + "\n" + claudeCloudNote(opts.apiUrl);
 }
 function nodeVersion() {
   return "22\n";
@@ -12783,9 +13001,12 @@ fi
 repo_root="$(cd -- "$(dirname -- "\${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 fail() { printf 'cloud-setup: %s\\n' "$1" >&2; exit 1; }
-command -v node >/dev/null 2>&1 || fail 'Node 22 is required. Select Node 22 in your cloud environment, then retry.'
-[[ "$(node -p 'process.versions.node.split(".")[0]')" == "22" ]] || fail 'Node 22 is required. Select Node 22 in your cloud environment, then retry. A subshell-only runtime change will not persist into agent commands.'
-command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22.'
+command -v node >/dev/null 2>&1 || fail 'Node 22 or 24 is required. Select Node 22 or 24 in your cloud environment, then retry.'
+case "$(node -p 'process.versions.node.split(".")[0]')" in
+  22|24) ;;
+  *) fail 'Node 22 or 24 is required. Select Node 22 or 24 in your cloud environment, then retry. A subshell-only runtime change will not persist into agent commands.' ;;
+esac
+command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22 or 24.'
 [[ -f package-lock.json && -f package.json ]] || fail 'Missing package.json or committed package-lock.json. Run this from a complete repository checkout.'
 
 # Only the Claude startup/resume path reuses an unchanged install. Explicit
@@ -12793,15 +13014,21 @@ command -v npm >/dev/null 2>&1 || fail 'npm is required with Node 22.'
 stamp="$(node --input-type=module -e 'import {createHash} from "node:crypto"; import {readFileSync} from "node:fs"; const hash=createHash("sha256"); for (const path of ["package.json", "package-lock.json", "scripts/cloud-setup.sh"]) hash.update(readFileSync(path)); hash.update(process.version); hash.update(process.platform); hash.update(process.arch); process.stdout.write(hash.digest("hex"));')"
 stamp_file="node_modules/.dashwise-cloud-setup"
 if [[ "\${1:-}" == "--claude" && -f "$stamp_file" && "$(cat "$stamp_file")" == "$stamp" && -x node_modules/.bin/next && -x node_modules/.bin/tsc && -f node_modules/@dashai/sdk/package.json ]]; then
-  printf 'cloud-setup: dependencies already match Node 22 and the lockfile.\\n'
+  printf 'cloud-setup: dependencies already match this Node version and the lockfile.\\n'
   exit 0
 fi
 # Keep install output out of session logs: third-party lifecycle scripts may
 # echo environment variables. npm's own detailed logs stay in its local cache.
 rm -f "$stamp_file"
-npm ci --include=dev --no-audit --no-fund > /dev/null 2>&1 || fail 'npm ci failed. Check the committed lockfile, Node 22 and network access to registry.npmjs.org. Review npm logs privately; never paste credentials.'
+# Some sandboxes mount HOME read-only; npm then cannot write its cache.
+npm_cache="\${npm_config_cache:-\${HOME:-}/.npm}"
+if ! { mkdir -p "$npm_cache" 2>/dev/null && [[ -w "$npm_cache" ]]; }; then
+  export npm_config_cache="\${TMPDIR:-/tmp}/npm-cache"
+  printf 'cloud-setup: %s is not writable, using %s for the npm cache.\\n' "$npm_cache" "$npm_config_cache"
+fi
+npm ci --include=dev --no-audit --no-fund > /dev/null 2>&1 || fail 'npm ci failed. Check the committed lockfile, Node 22 or 24 and network access to registry.npmjs.org. Review npm logs privately; never paste credentials.'
 printf '%s' "$stamp" > "$stamp_file"
-printf 'cloud-setup: dependencies installed with Node 22.\\n'
+printf 'cloud-setup: dependencies installed with Node %s.\\n' "$(node -p 'process.versions.node')"
 `;
 }
 function claudeSettingsJson() {
@@ -12957,7 +13184,7 @@ function cloudReadme() {
   return `
 ## Cloud builders
 
-Use Node 22 (the root runtime pins) and run \`bash scripts/cloud-setup.sh\`.
+Use Node 22 (the root runtime pins; 24 also works) and run \`bash scripts/cloud-setup.sh\`.
 Commit \`package-lock.json\` after any dependency change; setup uses \`npm ci\`.
 Checks: \`npm run typecheck\`, \`npm test\`, \`npm run build\`, \`npm run smoke:production\`.
 The smoke command starts the built server, probes anonymous API denial and stops
@@ -12966,33 +13193,49 @@ The example uses \`lib/items.ts\` directly against the SDK, so a fresh checkout
 can build without authenticated code generation. Keep it aligned with the
 example table, or replace it when you author your schema.
 
-Codex: select Node 22 in the provider environment and use
-\`bash scripts/cloud-setup.sh\` as setup/maintenance. GitHub authorization and
-the cloud environment are configured in the provider; these repo files do
-not create an environment or authorize your account.
+Codex: \`AGENTS.md\` \u2192 "Codex cloud environment" lists the exact settings
+(Node 22 or 24, setup script, network, \`DASHWISE_API_URL\`, no secrets);
+Codex's environment setup chat can follow it, then you click Publish. GitHub
+authorization is configured in the provider: install the ChatGPT Codex
+Connector on your GitHub organisation so Codex can see a private repository.
 
 Claude Code web: \`.claude/settings.json\` ships a cloud-only SessionStart
 hook for startup/resume. It calls \`bash "$CLAUDE_PROJECT_DIR"/scripts/cloud-setup.sh --claude\`;
 local sessions skip installation and unchanged cloud installs reuse dependencies.
-Select Node 22 in the environment; do not rely on a setup subshell changing the
+Select Node 22 or 24 in the environment; do not rely on a setup subshell changing the
 runtime of later agent commands. The same script can be used in the environment
 setup field. Allow \`registry.npmjs.org\` for installs (Claude's Trusted list).
 The [official hook recipe](https://code.claude.com/docs/en/cloud-environments#install-dependencies-with-a-sessionstart-hook)
 explains startup and cache behavior.
 
-Read \`AGENTS.md\` / \`CLAUDE.md\`, work on one branch and push. Release and Live
-remain human actions. No Dashwise token is needed for repository code delivery.
+Read \`AGENTS.md\` / \`CLAUDE.md\`. By default agents get the work onto the
+default branch themselves and explain each step in plain words; Release in
+Dashwise includes work an agent could only push to a branch. Release and Live
+remain human actions. No Dashwise token is needed for
+repository code delivery.
 `;
 }
-var DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX;
+var NODE_ENGINES, DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX, CLOUD_ALLOWED_HOSTS, HOSTED_API_HOSTS;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
     init_sdk_version();
     init_simple();
     init_custom();
+    NODE_ENGINES = "22.x || 24.x";
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
+    CLOUD_ALLOWED_HOSTS = [
+      "registry.npmjs.org",
+      "github.com",
+      "api.github.com",
+      "raw.githubusercontent.com",
+      "codeload.github.com"
+    ];
+    HOSTED_API_HOSTS = {
+      "api.dashwise.dev": "app.dashwise.dev",
+      "api.dashwise.net": "app.dashwise.net"
+    };
   }
 });
 function isFreshCloneEntry(name) {
@@ -13070,7 +13313,7 @@ function canAdoptCloudFiles(dir, templatePackage) {
     if (lock.lockfileVersion !== 2 && lock.lockfileVersion !== 3 || !root) {
       return false;
     }
-    if (pkg.engines?.node !== "22.x" || !pkg.scripts || !expected.scripts) {
+    if (pkg.engines?.node !== "22.x" && pkg.engines?.node !== expected.engines?.node || !pkg.scripts || !expected.scripts) {
       return false;
     }
     for (const script of ["typecheck", "test", "build", "start", "smoke:production"]) {
@@ -13173,12 +13416,14 @@ async function moduleInitCommand(slugArg, options) {
   const templatePackage = (kind === "custom" ? packageJsonCustom : packageJson)({
     slug});
   const cloudReady = writeMode === "all" || canAdoptCloudFiles(dir, templatePackage);
+  const companyApiUrl = resolveExplicitApiUrl();
   const scaffoldOpts = {
     cloudReady,
     slug,
     name,
     kind,
-    ...options.git !== void 0 ? { repositoryUrl: options.git } : {}
+    ...options.git !== void 0 ? { repositoryUrl: options.git } : {},
+    ...companyApiUrl !== null ? { apiUrl: companyApiUrl } : {}
   };
   const scaffoldApiUrl = resolveApiUrl();
   const files = [
@@ -13303,6 +13548,9 @@ async function moduleInitCommand(slugArg, options) {
       writeFileSync(absPath, content, "utf-8");
       written++;
     }
+    reportSecretLines(
+      syncEnvLocalSecretLines(dir, declaredSecretNames(readManifest(dir)))
+    );
   }
   if (writeMode !== "none" && !cloudReady) {
     process.stdout.write(
@@ -13376,7 +13624,7 @@ async function moduleInitCommand(slugArg, options) {
 
   ${dim("   (or, for the two-terminal flow:")}
   ${dim("     dashwise module generate")}              ${dim("# materialize typed wrappers")}
-  ${dim("     dashwise module dev")}                   ${dim("# watch + auto-regenerate")}
+  ${dim("     npm run dev:watch")}                     ${dim("# watch + auto-regenerate")}
   ${dim("     npm run dev:next                        # next dev on :3000)")}
 ${devInstall ? `
   ${dim(`Dev installation id=${devInstall.installation.id}; API key expires ${devInstall.api_key_expires_at}.`)}
@@ -13545,10 +13793,297 @@ var init_init = __esm({
     init_output();
     init_api_client();
     init_config();
+    init_declared_secrets();
     init_manifest_io();
     init_workspaces();
   }
 });
+
+// src/lib/manifest-evolution.ts
+function compareManifests(base, head, history = []) {
+  const violations = [];
+  const additions = [];
+  const warnings = [];
+  const v = (rule, where, detail) => violations.push({ rule, where, detail });
+  const baseTables = tablesOf(base);
+  const headTables = tablesOf(head);
+  const everTables = /* @__PURE__ */ new Set();
+  const everFields = /* @__PURE__ */ new Set();
+  for (const m of history) {
+    for (const [slug, t] of tablesOf(m)) {
+      everTables.add(slug);
+      for (const f of t.fields ?? []) everFields.add(`${slug}.${f.slug}`);
+    }
+  }
+  for (const [slug, bt] of baseTables) {
+    const ht = headTables.get(slug);
+    if (!ht) {
+      v("removed_table", slug, "tables are never removed; deprecate instead");
+      continue;
+    }
+    const bf = fieldsOf(bt);
+    const hf = fieldsOf(ht);
+    for (const [fs, f] of bf) {
+      const g = hf.get(fs);
+      const where = `${slug}.${fs}`;
+      if (!g) {
+        v("removed_field", where, "fields are never removed; stop writing it and set human_edit: open");
+        continue;
+      }
+      if (f.type !== g.type) v("retyped_field", where, `${f.type} \u2192 ${g.type}`);
+      if ((f.decimal_places ?? null) !== (g.decimal_places ?? null)) {
+        v("retyped_field", where, `decimal_places ${f.decimal_places ?? "none"} \u2192 ${g.decimal_places ?? "none"}`);
+      }
+      if ((f.target ?? null) !== (g.target ?? null)) v("retyped_field", where, `link target ${f.target} \u2192 ${g.target}`);
+      if (f.required !== true && g.required === true) {
+        v("required_tightened", where, "old rows are empty; enforce it in the tool layer instead");
+      }
+      const bo = f.options ?? [];
+      const ho = g.options ?? [];
+      for (const [i, o] of bo.entries()) {
+        if (!ho.includes(o)) v("removed_option", where, `option "${String(o)}" removed`);
+        else if (ho[i] !== o) {
+          v("reordered_option", where, `option "${String(o)}" moved from ${i} to ${ho.indexOf(o)}; options are append-only`);
+        }
+      }
+      for (const o of ho.slice(bo.length)) if (!bo.includes(o)) additions.push(`option ${where} "${String(o)}"`);
+    }
+    for (const [fs] of hf) {
+      if (bf.has(fs)) continue;
+      if (everFields.has(`${slug}.${fs}`)) {
+        v("slug_reused", `${slug}.${fs}`, "this slug was removed in an earlier version and may not come back");
+      } else additions.push(`field ${slug}.${fs}`);
+    }
+    const hu = new Set(uniqueIndexes(ht));
+    for (const idx of uniqueIndexes(bt)) {
+      if (!hu.has(idx)) v("dropped_unique_index", `${slug}(${idx})`, "a unique index is a protocol lock; it may not be dropped or changed");
+    }
+    const bu = new Set(uniqueIndexes(bt));
+    for (const idx of hu) {
+      if (bu.has(idx)) continue;
+      const overExisting = idx.split(",").some((f) => f.length > 0 && bf.has(f));
+      if (overExisting) {
+        v("unique_on_populated", `${slug}(${idx})`, "a new unique index (indexes[].unique) over existing fields fails on duplicates already stored; add a new field instead");
+      } else additions.push(`unique index ${slug}(${idx})`);
+    }
+  }
+  for (const [slug] of headTables) {
+    if (baseTables.has(slug)) continue;
+    if (everTables.has(slug)) v("slug_reused", slug, "this table slug was removed in an earlier version and may not come back");
+    else additions.push(`table ${slug}`);
+  }
+  const baseViews = new Set((base?.owns?.views ?? []).map((x) => x.slug));
+  const headViews = new Set((head?.owns?.views ?? []).map((x) => x.slug));
+  for (const s of baseViews) if (!headViews.has(s)) warnings.push(`view ${s} removed (callers of qbViews.${s} break)`);
+  for (const s of headViews) if (!baseViews.has(s)) additions.push(`view ${s}`);
+  return { violations, additions, warnings };
+}
+var tablesOf, fieldsOf, uniqueIndexes;
+var init_manifest_evolution = __esm({
+  "src/lib/manifest-evolution.ts"() {
+    tablesOf = (m) => new Map((m?.owns?.tables ?? []).map((t) => [t.slug, t]));
+    fieldsOf = (t) => new Map((t?.fields ?? []).map((f) => [f.slug, f]));
+    uniqueIndexes = (t) => (t?.indexes ?? []).filter((i) => i.unique === true).map((i) => (i.fields ?? []).join(","));
+  }
+});
+
+// src/commands/module/diff-check.ts
+var diff_check_exports = {};
+__export(diff_check_exports, {
+  EvolutionCheckError: () => EvolutionCheckError,
+  moduleDiffCheckCommand: () => moduleDiffCheckCommand,
+  printEvolutionReport: () => printEvolutionReport,
+  publishEvolutionGate: () => publishEvolutionGate,
+  runEvolutionCheck: () => runEvolutionCheck
+});
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new EvolutionCheckError(`could not read ${path}: ${err.message}`);
+  }
+}
+function git(cwd, args) {
+  try {
+    return execFileSync("git", ["-C", cwd, ...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 64 * 1024 * 1024
+    });
+  } catch (err) {
+    const stderr = err.stderr?.trim();
+    throw new EvolutionCheckError(`git ${args.join(" ")} failed${stderr ? `: ${stderr}` : ""}`);
+  }
+}
+async function runEvolutionCheck(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const headPath = options.head ? resolve(options.head) : join(projectRoot, "module.json");
+  if (!existsSync(headPath)) throw new EvolutionCheckError(`no manifest at ${headPath}`);
+  const head = readJson(headPath);
+  const baseFile = options.baseFile ?? (options.base && existsSync(options.base) ? options.base : void 0);
+  if (baseFile) {
+    const base = readJson(baseFile);
+    return { ...compareManifests(base, head), base: baseFile, head: headPath, history: 0, nothingReleased: false };
+  }
+  if (options.base) {
+    const ref = options.base;
+    const base = JSON.parse(git(projectRoot, ["show", `${ref}:./module.json`]));
+    let history2 = [];
+    if (!options.noHistory) {
+      const shas = git(projectRoot, ["log", "--format=%H", "--reverse", ref, "--", "module.json"]).split("\n").filter(Boolean);
+      history2 = shas.slice(0, -1).map((sha) => JSON.parse(git(projectRoot, ["show", `${sha}:./module.json`])));
+    }
+    return {
+      ...compareManifests(base, head, history2),
+      base: `${ref}:module.json`,
+      head: headPath,
+      history: history2.length,
+      nothingReleased: false
+    };
+  }
+  const slug = head.module?.slug;
+  if (!slug) throw new EvolutionCheckError(`${headPath} has no module.slug`);
+  let mod;
+  let versions;
+  try {
+    mod = await apiRequest(
+      "GET",
+      `/api/modules/by-slug/${encodeURIComponent(slug)}`
+    );
+    if (!mod.current_version) {
+      return {
+        violations: [],
+        additions: [],
+        warnings: [],
+        base: "(nothing released)",
+        head: headPath,
+        history: 0,
+        nothingReleased: true
+      };
+    }
+    versions = await apiRequest("GET", `/api/modules/${mod.id}/versions`);
+  } catch (err) {
+    const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
+    throw new EvolutionCheckError(
+      `could not read the released manifest of ${slug} (${why}); pass --base <ref|file> to check offline`
+    );
+  }
+  const released = versions.find((v) => v.version === mod.current_version);
+  if (!released?.manifest_jsonb) {
+    throw new EvolutionCheckError(
+      `the platform returned no manifest for ${slug} v${mod.current_version}; pass --base <ref|file> to check offline`
+    );
+  }
+  const releasedAt = released.created_on ? Date.parse(released.created_on) : Number.POSITIVE_INFINITY;
+  const history = options.noHistory ? [] : versions.filter((v) => v !== released && v.manifest_jsonb && v.created_on && Date.parse(v.created_on) < releasedAt).sort((a, b) => Date.parse(a.created_on) - Date.parse(b.created_on)).map((v) => v.manifest_jsonb);
+  return {
+    ...compareManifests(released.manifest_jsonb, head, history),
+    base: `${slug} v${mod.current_version} (released)`,
+    head: headPath,
+    history: history.length,
+    nothingReleased: false
+  };
+}
+function printEvolutionReport(r, print = out) {
+  print(`module diff --check: ${r.head} against ${r.base} (${r.history} older version${r.history === 1 ? "" : "s"} scanned)`);
+  for (const a of r.additions) print(`  + ${a}`);
+  for (const w of r.warnings) print(`  ! ${w}`);
+  for (const x of r.violations) print(`  \u2717 ${x.rule}: ${x.where}: ${x.detail}`);
+}
+async function moduleDiffCheckCommand(options) {
+  let r;
+  try {
+    r = await runEvolutionCheck(options);
+  } catch (err) {
+    if (err instanceof EvolutionCheckError) {
+      if (options.json) out(JSON.stringify({ ok: false, error: { code: "CHECK_FAILED", message: err.message } }));
+      else fail(`module diff --check: ${err.message}`);
+      return 2;
+    }
+    throw err;
+  }
+  if (options.json) {
+    out(JSON.stringify({ ok: r.violations.length === 0, ...r }, null, 2));
+    return r.violations.length === 0 ? 0 : 1;
+  }
+  if (r.nothingReleased) {
+    success("Nothing released yet: every change is additive.");
+    return 0;
+  }
+  printEvolutionReport(r);
+  if (r.violations.length === 0) {
+    success("additive");
+    return 0;
+  }
+  fail(`${r.violations.length} violation(s): not additive. Released copies would lose data or fail to upgrade.`);
+  info(`Add a new field or table instead, and stop writing the old one (${code('human_edit: "open"')}).`);
+  return 1;
+}
+async function publishEvolutionGate(projectRoot, strict) {
+  let r;
+  try {
+    r = await runEvolutionCheck({ dir: projectRoot });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (strict) {
+      fail(`Evolution check could not run (${msg}). Refusing with --strict. Nothing was published.`);
+      return 1;
+    }
+    warn(`Evolution check skipped: ${msg}.`);
+    return 0;
+  }
+  if (r.nothingReleased || r.violations.length === 0) return 0;
+  printEvolutionReport(r, (s) => (strict ? fail : warn)(s));
+  if (strict) {
+    fail(
+      `module.json is not an additive evolution of the released version (${r.violations.length} violation(s)). Refusing with --strict. Nothing was published.`
+    );
+    return 1;
+  }
+  warn(
+    `module.json is not an additive evolution of the released version: installs that upgrade lose the data above. ${code("--strict")} turns this into a refusal; ${code("dashwise module diff --check")} shows it on its own.`
+  );
+  return 0;
+}
+var EvolutionCheckError;
+var init_diff_check = __esm({
+  "src/commands/module/diff-check.ts"() {
+    init_api_client();
+    init_manifest_evolution();
+    init_output();
+    EvolutionCheckError = class extends Error {
+    };
+  }
+});
+
+// src/lib/manifest-reference-lint.ts
+function referenceFieldWarnings(manifest) {
+  const tables = manifest?.owns?.tables;
+  if (!Array.isArray(tables)) return [];
+  const warnings = [];
+  for (const table of tables) {
+    if (typeof table?.slug !== "string" || !Array.isArray(table.fields)) continue;
+    for (const field of table.fields) {
+      if (typeof field?.slug !== "string" || typeof field.type !== "string") continue;
+      if (field.slug === "id" || !REFERENCE_NAME.test(field.slug)) continue;
+      if (!PLAIN_TYPES.has(field.type)) continue;
+      warnings.push({
+        table: table.slug,
+        field: field.slug,
+        type: field.type,
+        message: `${table.slug}.${field.slug} is a ${field.type} field named like a reference. If it points at a row in Dashwise, use a link_row field: plain ids break silently when data is copied to another installation. Ignore this for ids from outside systems.`
+      });
+    }
+  }
+  return warnings;
+}
+var REFERENCE_NAME, PLAIN_TYPES;
+var init_manifest_reference_lint = __esm({
+  "src/lib/manifest-reference-lint.ts"() {
+    REFERENCE_NAME = /(?:_id|_ref|Id|Ref)$/;
+    PLAIN_TYPES = /* @__PURE__ */ new Set(["number", "text", "autonumber"]);
+  }
+});
 function loadSchemaCommandContext(opts) {
   const projectRoot = resolve(opts.dir ?? process.cwd());
   const manifestPath2 = join(projectRoot, "module.json");
@@ -13621,6 +14156,89 @@ var init_dotenv_local = __esm({
   }
 });
 
+// src/lib/install-target.ts
+function keyDisplayPrefix(apiKey) {
+  if (!apiKey.startsWith(KEY_SCHEME)) return null;
+  const prefix = apiKey.slice(KEY_SCHEME.length, KEY_SCHEME.length + KEY_PREFIX_CHARS);
+  return prefix.length === KEY_PREFIX_CHARS ? prefix : null;
+}
+async function keyBelongsToInstall(apiKey, installationId, options, now = /* @__PURE__ */ new Date()) {
+  const prefix = keyDisplayPrefix(apiKey);
+  if (prefix === null) return false;
+  const { api_keys } = await listApiKeys(installationId, options);
+  return api_keys.some(
+    (k) => k.installation_id === installationId && k.key_prefix === prefix && (k.status === void 0 || k.status === "active") && k.revoked_at === null && (k.expires_at === null || new Date(k.expires_at) > now)
+  );
+}
+function formatInstallTarget(id, detail) {
+  return detail ? `\u2192 install #${id} (${detail})` : `\u2192 install #${id}`;
+}
+async function nameKeyTarget(args) {
+  const { apiKey, keySource, entry, cfg, apiUrl, install } = args;
+  const request = cfg ? { baseUrl: apiUrl, auth: { token: cfg.token }, signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS) } : null;
+  if (install === void 0) {
+    if (keySource !== "cached" || !entry) {
+      info(
+        `\u2192 install not checked: ${code("DASHWISE_API_KEY")} comes from ${keySource === "environment" ? "the environment" : code(".env.local")}. Pass ${code("--install <id>")} to name its target and refuse a mismatch.`
+      );
+      return 0;
+    }
+    if (!request || entry.workspaceId === void 0) {
+      info(formatInstallTarget(entry.installationId, "the cached dev install"));
+      return 0;
+    }
+    try {
+      const workspaces = await apiRequest("GET", "/api/workspaces", void 0, request);
+      const ws = workspaces.find((w) => w.id === entry.workspaceId);
+      info(formatInstallTarget(entry.installationId, `${ws ? ws.slug : `workspace #${entry.workspaceId}`}, local`));
+    } catch {
+      info(formatInstallTarget(entry.installationId));
+    }
+    return 0;
+  }
+  const source = keySource === "cached" ? "the cached key" : `${code("DASHWISE_API_KEY")} (from ${keySource === "environment" ? "the environment" : code(".env.local")})`;
+  if (!request) {
+    fail(
+      `${code("--install")} looks the install up with your CLI login, and there is none. Run ${code("dashwise login")} first. Nothing was run.`
+    );
+    return 1;
+  }
+  let belongs;
+  try {
+    belongs = await keyBelongsToInstall(apiKey, install, request);
+  } catch (err) {
+    fail(
+      `Could not read the keys of install #${install} to confirm ${source} (${describe(err)}). Refusing to run against an unconfirmed install. Nothing was run.`
+    );
+    return 1;
+  }
+  const cachedDev = entry?.installationId === install ? "the cached dev install, " : "";
+  if (!belongs) {
+    const other = entry && entry.installationId !== install && entry.apiKey === apiKey ? ` It is the cached key of install #${entry.installationId}.` : "";
+    fail(`${source} is not a live key of install #${install}.${other} Nothing was run.`);
+    info(
+      `Use a key of install #${install} (mint one with ${code(`dashwise api-keys create <name> --install ${install}`)}), or drop ${code("--install")} to run against the key's own install.`
+    );
+    return 1;
+  }
+  info(formatInstallTarget(install, `${cachedDev}key checked`));
+  return 0;
+}
+function describe(err) {
+  if (err instanceof ApiError) return `${err.code || err.status} ${err.message}`;
+  return err.message;
+}
+var KEY_PREFIX_CHARS, KEY_SCHEME, LOOKUP_TIMEOUT_MS;
+var init_install_target = __esm({
+  "src/lib/install-target.ts"() {
+    init_api_client();
+    init_output();
+    KEY_PREFIX_CHARS = 8;
+    KEY_SCHEME = "dwk_";
+    LOOKUP_TIMEOUT_MS = 1500;
+  }
+});
+
 // src/commands/run.ts
 var run_exports = {};
 __export(run_exports, {
@@ -13633,6 +14251,10 @@ async function runCommand(cmdArgs, options) {
     );
     return 1;
   }
+  if (options.install !== void 0 && (!Number.isInteger(options.install) || options.install <= 0)) {
+    fail(`--install expects a positive integer installation id (got "${options.install}").`);
+    return 1;
+  }
   const projectRoot = resolve(options.dir ?? process.cwd());
   let manifestSlug;
   try {
@@ -13645,6 +14267,7 @@ async function runCommand(cmdArgs, options) {
     fail(`module.json has no ${code("module.slug")} \u2014 the manifest is malformed.`);
     return 1;
   }
+  const keyInShell = process.env.DASHWISE_API_KEY !== void 0;
   hydrateEnvFromDotenvLocal(projectRoot);
   const cfg = (() => {
     try {
@@ -13655,8 +14278,19 @@ async function runCommand(cmdArgs, options) {
   })();
   const apiUrl = process.env.DASHWISE_API_URL ?? cfg?.apiUrl ?? "http://localhost:3000";
   let apiKey = process.env.DASHWISE_API_KEY;
+  let keySource = keyInShell ? "environment" : ".env.local";
+  let entry = null;
   if (!apiKey) {
-    let entry = readModuleEntry(manifestSlug);
+    entry = readModuleEntry(manifestSlug);
+    if (entry && options.install !== void 0 && entry.installationId !== options.install) {
+      fail(
+        `No key for install #${options.install}: the cached ${code("dwk_")} key of ${code(manifestSlug)} belongs to install #${entry.installationId}. Nothing was run.`
+      );
+      info(
+        `Set ${code("DASHWISE_API_KEY")} to a key of install #${options.install} (mint one with ${code(`dashwise api-keys create <name> --install ${options.install}`)}).`
+      );
+      return 1;
+    }
     if (cfg) {
       const healed = await resolveModuleApiKey(
         manifestSlug,
@@ -13667,6 +14301,7 @@ async function runCommand(cmdArgs, options) {
       if (healed) entry = healed;
     }
     apiKey = entry?.apiKey;
+    keySource = "cached";
   }
   if (!apiKey) {
     fail(
@@ -13677,6 +14312,15 @@ async function runCommand(cmdArgs, options) {
     );
     return 1;
   }
+  const target = await nameKeyTarget({
+    apiKey,
+    keySource,
+    entry: entry ?? readModuleEntry(manifestSlug),
+    cfg,
+    apiUrl,
+    ...options.install !== void 0 ? { install: options.install } : {}
+  });
+  if (target !== 0) return target;
   const [cmd, ...rest] = cmdArgs;
   info(
     `${dim("run")} ${cmd} ${rest.join(" ")} ${dim(`(DASHWISE_API_URL=${apiUrl}, DASHWISE_API_KEY injected)`)}`
@@ -13706,6 +14350,7 @@ var init_run = __esm({
   "src/commands/run.ts"() {
     init_config();
     init_dotenv_local();
+    init_install_target();
     init_manifest_io();
     init_output();
     init_dev();
@@ -13996,6 +14641,7 @@ async function schemaPushCommand(options) {
     return surfaceSchemaPushError(err, slug);
   }
   printApplySummary(applied);
+  for (const w of referenceFieldWarnings(manifest)) warn(w.message);
   if (dwkAuth) {
     try {
       const { manifest: canonical } = await getInstallationSchema(dwkAuth);
@@ -14144,6 +14790,7 @@ var init_push = __esm({
     init_manifest_io();
     init_manifest_merge();
     init_output();
+    init_manifest_reference_lint();
   }
 });
 
@@ -14721,6 +15368,26 @@ var init_set_type = __esm({
   }
 });
 
+// src/lib/env-proxy.ts
+var PROXY_VARS = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+function hasProxyEnv(env = process.env) {
+  return PROXY_VARS.some((name) => Boolean(env[name]?.trim()));
+}
+async function installEnvProxy(env = process.env) {
+  if (!hasProxyEnv(env)) return false;
+  const undici = await import('undici');
+  undici.setGlobalDispatcher(new undici.EnvHttpProxyAgent());
+  Object.assign(globalThis, {
+    fetch: undici.fetch,
+    FormData: undici.FormData,
+    Headers: undici.Headers,
+    Request: undici.Request,
+    Response: undici.Response
+  });
+  env.NODE_USE_ENV_PROXY ??= "1";
+  return true;
+}
+
 // src/lib/excess-args.ts
 init_output();
 var SMART_DASH_RE = /^[‒–—―−]/;
@@ -15128,7 +15795,7 @@ init_api_client();
 init_config();
 init_output();
 init_sdk_version();
-var MIN_NODE_MAJOR = 20;
+var MIN_NODE = [20, 18, 1];
 var CLOUD_FILES = [
   "scripts/cloud-setup.sh",
   ".claude/settings.json",
@@ -15348,13 +16015,20 @@ function unreachable(apiUrl) {
   };
 }
 function nodeCheck(version) {
-  const major = Number.parseInt(version.replace(/^v/, ""), 10);
-  return Number.isFinite(major) && major >= MIN_NODE_MAJOR ? { id: "node", label: "Node", status: "ok", detail: version } : {
+  const parts = version.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10));
+  let supported = parts.length === 3 && parts.every(Number.isFinite);
+  for (let i = 0; supported && i < 3; i++) {
+    if (parts[i] !== MIN_NODE[i]) {
+      supported = parts[i] > MIN_NODE[i];
+      break;
+    }
+  }
+  return supported ? { id: "node", label: "Node", status: "ok", detail: version } : {
     id: "node",
     label: "Node",
     status: "fail",
     detail: `${version} is too old`,
-    fix: `Install Node ${MIN_NODE_MAJOR} or newer (the template pins Node 22).`
+    fix: `Install Node ${MIN_NODE.join(".")} or newer (the template pins Node 22).`
   };
 }
 async function versionCheck(id, label, installed, latest, fix) {
@@ -15674,8 +16348,8 @@ function startMcpProxy(opts) {
   let streamUnavailable = false;
   let streamStarted = false;
   let resolveDone;
-  const done = new Promise((resolve15) => {
-    resolveDone = resolve15;
+  const done = new Promise((resolve16) => {
+    resolveDone = resolve16;
   });
   const trace = (line) => {
     if (verbose) log2(line);
@@ -16161,7 +16835,7 @@ async function revokeSession(endpointId) {
     () => false
   );
   const timeout = new Promise(
-    (resolve15) => setTimeout(() => resolve15(false), REVOKE_TIMEOUT_MS).unref()
+    (resolve16) => setTimeout(() => resolve16(false), REVOKE_TIMEOUT_MS).unref()
   );
   await Promise.race([attempt, timeout]);
 }
@@ -16339,7 +17013,7 @@ async function mcpAddCommand(options = {}) {
     fail(`Could not run \`claude\`: ${target.refused} Run the command above yourself.`);
     return 1;
   }
-  return await new Promise((resolve15) => {
+  return await new Promise((resolve16) => {
     const child = spawn(target.command, target.args, { shell: target.shell, stdio: "inherit" });
     let settled = false;
     child.on("error", (err) => {
@@ -16349,16 +17023,16 @@ async function mcpAddCommand(options = {}) {
         fail(
           `Claude Code is not on your PATH, so nothing was registered. Run the command above once ${code("claude")} is installed.`
         );
-        resolve15(1);
+        resolve16(1);
         return;
       }
       fail(`Could not run \`claude\`: ${err.message}`);
-      resolve15(1);
+      resolve16(1);
     });
     child.on("close", (codeOut) => {
       if (settled) return;
       settled = true;
-      resolve15(codeOut ?? 1);
+      resolve16(codeOut ?? 1);
     });
   });
 }
@@ -16477,10 +17151,10 @@ function upgradeCommand(plugin, marketplace) {
 var PLUGIN_NAME = "dashwise";
 var MARKETPLACE_NAME = "dashwise";
 var DEFAULT_MARKETPLACE_SOURCE = "Intuize/dashwise-cli";
-var defaultRunner = (cmd, args, opts) => new Promise((resolve15) => {
+var defaultRunner = (cmd, args, opts) => new Promise((resolve16) => {
   const target = spawnTarget(cmd, args);
   if ("refused" in target) {
-    resolve15({ code: null, stdout: "", stderr: target.refused, missing: false });
+    resolve16({ code: null, stdout: "", stderr: target.refused, missing: false });
     return;
   }
   const child = spawn(target.command, target.args, {
@@ -16495,7 +17169,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolve15) => {
   child.on("error", (err) => {
     if (settled) return;
     settled = true;
-    resolve15({
+    resolve16({
       code: null,
       stdout,
       stderr: stderr || err.message,
@@ -16505,7 +17179,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolve15) => {
   child.on("close", (exitCode) => {
     if (settled) return;
     settled = true;
-    resolve15({ code: exitCode, stdout, stderr, missing: false });
+    resolve16({ code: exitCode, stdout, stderr, missing: false });
   });
 });
 function readSkillsOnDisk() {
@@ -17746,6 +18420,7 @@ function judgeGeneratorStamp(stamp, opts = {}) {
 // src/commands/module/generate.ts
 init_sdk_version();
 init_output();
+init_declared_secrets();
 function outputDir(projectRoot) {
   return join(projectRoot, "node_modules", "@dashai", "generated");
 }
@@ -17822,6 +18497,9 @@ async function moduleGenerateCommand(options) {
   info(`Hash: ${dim(res.contentHash)}`);
   if (verdict.note !== null && declaresUses(manifest)) info(verdict.note);
   warnIfSdkBelowUsesFloor(projectRoot, manifest);
+  reportSecretLines(
+    syncEnvLocalSecretLines(projectRoot, declaredSecretNames(manifest))
+  );
   return 0;
 }
 function declaresUses(manifest) {
@@ -18080,6 +18758,101 @@ init_init();
 // src/commands/module/install.ts
 init_api_client();
 init_config();
+
+// src/lib/agent-session.ts
+var MARKERS = [
+  ["CLAUDECODE", (v) => v === "1"],
+  ["CLAUDE_CODE_REMOTE", (v) => v === "true"],
+  ["CODEX_SANDBOX", (v) => v.length > 0],
+  ["CODEX_SANDBOX_NETWORK_DISABLED", (v) => v.length > 0],
+  ["CURSOR_AGENT", (v) => v.length > 0],
+  ["DW_AGENT", (v) => v.length > 0],
+  ["DASHWISE_AGENT_SESSION", (v) => v === "1" || v === "true"]
+];
+function agentSessionMarker(env = process.env) {
+  for (const [name, test] of MARKERS) {
+    const value = env[name];
+    if (value !== void 0 && test(value)) return name;
+  }
+  return null;
+}
+
+// src/lib/drift-preview.ts
+init_api_client();
+function redactedConsumer(redacted) {
+  switch (redacted) {
+    case "private_copy":
+      return "someone's private copy";
+    case "other_team_copy":
+      return "another team's copy";
+    case "development_copy":
+      return "a development copy you cannot see";
+    default:
+      return "a copy you cannot see";
+  }
+}
+var WIDEN_WORDS = {
+  uses_need_added: "a new table it reads from another module",
+  uses_ops_widened: "more operations on a table it reads",
+  uses_fields_added: "more fields of a table it reads",
+  dependency_added: "a new or wider dependency",
+  exposes_widened: "more of what it exposes to other modules",
+  permissions_added: "more permissions",
+  roles_widened: "more roles or permission keys",
+  outbound_added: "new outbound APIs (data can leave)",
+  secrets_added: "new secrets",
+  public_access_enabled: "public access"
+};
+function describeWidening(widening) {
+  return widening.map((w) => WIDEN_WORDS[w] ?? w).join(", ");
+}
+async function getUpgradePreview(installationId, version, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/upgrade-preview?version=${encodeURIComponent(version)}`,
+    void 0,
+    options
+  );
+}
+function count(n, unit) {
+  if (n === null) return `${unit}s not counted`;
+  return `${n.toLocaleString("en-US")} ${unit}${n === 1 ? "" : "s"}`;
+}
+function describeDrift(drift) {
+  const lines = [];
+  const d = drift.details;
+  const removedTables = d?.tables_to_remove ?? drift.tables_to_remove.map((t) => ({ table: t, name: t, rows: null }));
+  for (const t of removedTables) {
+    lines.push({
+      loses: t.rows !== 0,
+      text: `Moves table ${t.table} (${count(t.rows, "row")}) to the Trash`
+    });
+  }
+  const removedFields = d?.fields_to_remove ?? drift.fields_to_remove.map((f) => ({ ...f, name: f.field, values: null }));
+  for (const f of removedFields) {
+    lines.push({
+      loses: f.values !== 0,
+      text: `Moves field ${f.table}.${f.field} (${count(f.values, "value")}) to the Trash`
+    });
+  }
+  const retyped = d?.fields_to_retype ?? (drift.fields_to_retype ?? []).map((f) => ({ ...f, name: f.field, values: null }));
+  for (const f of retyped) {
+    lines.push({
+      loses: f.values !== 0,
+      text: `Converts field ${f.table}.${f.field} from ${f.from} to ${f.to} (${count(f.values, "value")}; a value that does not convert is lost)`
+    });
+  }
+  lines.sort((a, b) => Number(b.loses) - Number(a.loses));
+  for (const t of drift.tables_to_create) {
+    lines.push({ loses: false, text: `Adds table ${t}` });
+  }
+  for (const f of drift.fields_to_create) {
+    lines.push({ loses: false, text: `Adds field ${f.table}.${f.field}` });
+  }
+  return lines;
+}
+
+// src/commands/module/install.ts
 init_manifest_io();
 
 // src/lib/module-lifecycle.ts
@@ -18258,18 +19031,31 @@ async function moduleInstallCommand(slugArg, options) {
       );
     }
   }
-  if (!options.yes && process.stdout.isTTY && !confirmedViaPicker) {
-    const message = devInstallToReplace ? isUpgrade ? `Destroy the dev install (revokes local-dev credentials) and upgrade ${code(mod.slug)} to ${code(`v${targetVersion}`)} in ${code(workspace2.slug)}?` : `Replace the dev install (revokes local-dev credentials) and install ${code(mod.slug)} ${code(`v${targetVersion}`)} into ${code(workspace2.slug)} as production?` : `${isUpgrade ? "Upgrade" : "Install"} ${code(mod.slug)} ${code(`v${targetVersion}`)} into workspace ${code(workspace2.slug)}?`;
+  let preview;
+  let lossy = false;
+  let lossAccepted = false;
+  if (existing) {
+    const rerun = rerunLine(mod.slug, workspace2.slug, targetVersion, options, devInstallToReplace !== void 0);
+    const previewed = await previewUpgrade(existing.id, targetVersion, options, auth, rerun, devInstallToReplace?.id);
+    if (typeof previewed === "number") return previewed;
+    preview = previewed.preview;
+    lossy = previewed.lossy;
+    lossAccepted = previewed.accepted;
+  }
+  const askForLoss = lossy && !lossAccepted;
+  if (askForLoss || !options.yes && process.stdout.isTTY && !confirmedViaPicker) {
+    const lossClause = lossy ? " It moves the data listed above to the Trash or converts it." : "";
+    const message = devInstallToReplace ? isUpgrade ? `Destroy the dev install (revokes local-dev credentials) and upgrade ${code(mod.slug)} to ${code(`v${targetVersion}`)} in ${code(workspace2.slug)}?${lossClause}` : `Replace the dev install (revokes local-dev credentials) and install ${code(mod.slug)} ${code(`v${targetVersion}`)} into ${code(workspace2.slug)} as production?` : `${isUpgrade ? "Upgrade" : "Install"} ${code(mod.slug)} ${code(`v${targetVersion}`)} into workspace ${code(workspace2.slug)}?${lossClause}`;
     const answer = await select({
       message,
       options: [
         {
           value: "go",
-          label: devInstallToReplace ? isUpgrade ? "Yes, destroy the dev install + upgrade" : "Yes, replace the dev install + production-install" : isUpgrade ? "Yes, upgrade now" : "Yes, install now"
+          label: devInstallToReplace ? isUpgrade ? lossy ? "Yes, destroy the dev install + upgrade and lose the data listed above" : "Yes, destroy the dev install + upgrade" : "Yes, replace the dev install + production-install" : isUpgrade ? lossy ? "Yes, upgrade and lose the data listed above" : "Yes, upgrade now" : "Yes, install now"
         },
         { value: "cancel", label: "No, abort" }
       ],
-      initialValue: devInstallToReplace ? "cancel" : "go"
+      initialValue: devInstallToReplace || lossy ? "cancel" : "go"
     });
     if (isCancel(answer) || answer === "cancel") {
       fail("Aborted. Nothing was changed.");
@@ -18291,7 +19077,9 @@ async function moduleInstallCommand(slugArg, options) {
         workspaceId: workspace2.id,
         version: targetVersion,
         ...existing ? { installation_id: existing.id } : {},
-        ...options.force !== void 0 ? { force: options.force } : {}
+        ...options.force !== void 0 ? { force: options.force } : {},
+        // P5-08: confirms exactly the delta that was shown (409 DRIFT_CHANGED otherwise).
+        ...preview ? { drift_hash: preview.drift_hash } : {}
       },
       auth
     );
@@ -18343,6 +19131,9 @@ async function moduleInstallCommand(slugArg, options) {
         was_upgrade: result.was_upgrade,
         public_url: publicUrl,
         verified,
+        // P5-08: the confirmed preview; `null` for a fresh install (nothing to preview).
+        drift_hash: preview?.drift_hash ?? null,
+        data_loss: preview ? lossy : null,
         // `null` when the binding surface was unreachable; `[]` when the
         // module declares no slots. The two are not the same thing.
         uses: readiness === null ? null : usesInstallJson(readiness),
@@ -18511,6 +19302,19 @@ function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
   Ask the module's author to invite this workspace (or open the install gate), then retry.`
         );
         break;
+      case "DRIFT_CHANGED":
+        fail(
+          `Install ${code(slug)} changed since its upgrade preview, so the confirmed change no longer matches. Nothing was changed.
+  Re-run ${code("dashwise module install")} to see the new preview.`
+        );
+        break;
+      case "DATA_LOSS_CONFIRM_REQUIRED":
+      case "UPGRADE_CONFIRM_REQUIRED":
+        fail(
+          `The platform asks for a confirmed preview before this upgrade (${err.code}). Nothing was changed.
+  Re-run ${code("dashwise module install")}: it previews the upgrade and sends the confirmation.`
+        );
+        break;
       case "UPGRADE_BREAKS_CONSUMERS":
         fail(
           `Upgrading ${code(slug)} would break modules that consume its current schema.
@@ -18560,6 +19364,75 @@ function usesInstallJson(readiness) {
     }))
   };
 }
+async function previewUpgrade(installationId, targetVersion, options, auth, rerun, devInstallToReplaceId) {
+  let preview;
+  try {
+    preview = await getUpgradePreview(installationId, targetVersion, auth);
+  } catch (err) {
+    const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
+    const checkNote = options.acceptDataLoss !== void 0 ? `, so ${code("--accept-data-loss")} cannot be checked` : "";
+    fail(
+      `Could not preview what upgrading install #${installationId} to ${code(`v${targetVersion}`)} does to its data (${why})${checkNote}. Nothing was changed.`
+    );
+    info(`An upgrade is never applied without its preview; retry when the platform answers.`);
+    return 1;
+  }
+  const lines = describeDrift(preview.drift);
+  const lossy = lines.some((l) => l.loses);
+  const from = preview.from_version ? `v${preview.from_version}` : "its current version";
+  if (lines.length === 0) {
+    info(`Upgrading install #${installationId} from ${from} to v${preview.to_version} changes no table or field.`);
+  } else {
+    info(`What upgrading install #${installationId} from ${from} to v${preview.to_version} does to its data:`);
+    for (const line of lines) {
+      (line.loses ? warn : info)(`  ${line.text}`);
+    }
+  }
+  const broken = preview.breaks_consumers ?? [];
+  if (broken.length > 0) {
+    const names = broken.map(
+      (c2) => c2.module_slug ? `${c2.module_slug}${c2.installation_id ? ` #${c2.installation_id}` : ""}` : redactedConsumer(c2.redacted)
+    );
+    warn(`  Breaks ${broken.length} module${broken.length === 1 ? "" : "s"} that read${broken.length === 1 ? "s" : ""} this one: ${names.join(", ")}`);
+  }
+  if (preview.approval_required) {
+    const asks = preview.widening && preview.widening.length > 0 ? `: it asks for ${describeWidening(preview.widening)}` : "";
+    warn(`  This update waits for the module author's approval${asks}.`);
+  }
+  if (options.acceptDataLoss !== void 0 && options.acceptDataLoss !== preview.drift_hash) {
+    fail(
+      `${code("--accept-data-loss")} does not match this upgrade's preview: the copy or the release changed since that hash was printed. Nothing was changed.`
+    );
+    info(`To accept the change listed above, a person re-runs:
+  ${rerun(preview.drift_hash)}`);
+    return 1;
+  }
+  const accepted = lossy && options.acceptDataLoss === preview.drift_hash;
+  if (lossy && !accepted) {
+    const yesNote = options.yes ? ` ${code("--yes")} does not accept data loss.` : "";
+    const marker = agentSessionMarker();
+    const why = marker ? `this is an agent session (${code(marker)} is set): a person decides` : !process.stdout.isTTY ? "there is no terminal to ask in" : null;
+    if (why) {
+      const alsoDev = devInstallToReplaceId !== void 0 ? ` and destroys dev install #${devInstallToReplaceId} first` : "";
+      fail(`This upgrade loses the data listed above${alsoDev}, and ${why}.${yesNote} Refused. Nothing was changed.`);
+      info(`To accept exactly that loss, a person re-runs:
+  ${rerun(preview.drift_hash)}`);
+      return 1;
+    }
+  }
+  return { preview, lossy, accepted };
+}
+function rerunLine(slug, workspaceSlug, targetVersion, options, replacingDevInstall) {
+  return (hash) => [
+    "dashwise module install",
+    slug,
+    `--workspace ${workspaceSlug}`,
+    `--version ${targetVersion}`,
+    ...options.force ? ["--force"] : [],
+    ...replacingDevInstall ? ["--replace-dev-install"] : [],
+    `--accept-data-loss ${hash}`
+  ].join(" ");
+}
 
 // src/commands/module/list.ts
 init_api_client();
@@ -18929,6 +19802,7 @@ function formatBytes(n) {
 }
 
 // src/commands/module/publish.ts
+init_diff_check();
 var VALID_BUMP = /* @__PURE__ */ new Set(["patch", "minor", "major"]);
 var PACKED_FILE_LIST_CAP = 20;
 function packedFileLines(files, cap = PACKED_FILE_LIST_CAP) {
@@ -19015,6 +19889,10 @@ async function modulePublishCommand(options) {
   info(
     `Module: ${code(mod.slug)} (id ${mod.id})${mod.current_version ? `, current ${code(`v${mod.current_version}`)}` : dim(", no published version yet")}`
   );
+  if (mod.current_version) {
+    const gate = await publishEvolutionGate(projectRoot, options.strict === true);
+    if (gate !== 0) return gate;
+  }
   let tarball;
   try {
     tarball = await packTarball({
@@ -19606,7 +20484,7 @@ async function moduleReleaseCommand(slugArg, options) {
   }
   async function wait() {
     const remaining = Math.max(0, deadline - Date.now());
-    await new Promise((resolve15) => setTimeout(resolve15, Math.min(options.pollIntervalMs ?? 4e3, remaining)));
+    await new Promise((resolve16) => setTimeout(resolve16, Math.min(options.pollIntervalMs ?? 4e3, remaining)));
   }
 }
 
@@ -20028,6 +20906,7 @@ async function modulePullDataCommand(options) {
 // src/commands/module/validate.ts
 init_api_client();
 init_output();
+init_manifest_reference_lint();
 async function moduleValidateCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
   const manifestPath2 = join(projectRoot, "module.json");
@@ -20052,6 +20931,7 @@ async function moduleValidateCommand(options) {
     );
     if (res.ok) {
       success("Manifest is valid.");
+      for (const w of referenceFieldWarnings(manifest)) warn(w.message);
       return 0;
     }
     fail(`Unexpected response shape: ${JSON.stringify(res)}`);
@@ -22454,6 +23334,23 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
+init_declared_secrets();
+var SECRETS_NOTE = "# Declared secrets (runtime.secrets[]): set each value on your host; Dashwise never exports a secret value.";
+function secretNameLines(names, format) {
+  const lines = names.map((name) => {
+    switch (format) {
+      case "env":
+        return `# ${name}=`;
+      case "railway":
+        return `# ${name}: railway variables set ${name}='<value>'`;
+      case "vercel":
+        return `# ${name}: vercel env add ${name} production`;
+      case "fly":
+        return `# ${name}: fly secrets set ${name}='<value>'`;
+    }
+  });
+  return [SECRETS_NOTE, ...lines].join("\n");
+}
 var PLACEHOLDER = "<run-`dashwise-api-keys-create-<name>`-and-paste-here>";
 async function envExportCommand(options) {
   const format = options.format ?? "env";
@@ -22544,7 +23441,19 @@ async function envExportCommand(options) {
       ...apiKeyComment !== null ? { comment: apiKeyComment } : {}
     }
   ];
+  const secretNames = options.withSecretNames ? declaredSecretNames(manifest) : [];
   process.stdout.write(render(entries, format));
+  if (secretNames.length > 0) {
+    if (format === "json") {
+      info(
+        `Declared secrets to set on your host (Dashwise never exports a secret value): ${secretNames.join(", ")}`
+      );
+    } else {
+      process.stdout.write(`
+
+${secretNameLines(secretNames, format)}`);
+    }
+  }
   if (format !== "json") process.stdout.write("\n");
   if (apiKey === PLACEHOLDER) {
     info("");
@@ -22600,6 +23509,7 @@ init_config();
 init_dotenv_local();
 init_manifest_io();
 init_output();
+init_install_target();
 init_dev();
 async function queryCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
@@ -22622,17 +23532,25 @@ async function queryCommand(options) {
     );
     return 1;
   }
+  const keyInShell = process.env.DASHWISE_API_KEY !== void 0;
   hydrateEnvFromDotenvLocal(projectRoot);
+  const cfg = (() => {
+    try {
+      return readConfig();
+    } catch {
+      return null;
+    }
+  })();
+  const apiUrl = process.env.DASHWISE_API_URL ?? cfg?.apiUrl ?? "http://localhost:3000";
+  let keySource = keyInShell ? "environment" : ".env.local";
+  let entry = manifestSlug ? readModuleEntry(manifestSlug) : null;
   if (!process.env.DASHWISE_API_KEY && manifestSlug) {
-    const cfg = (() => {
-      try {
-        return readConfig();
-      } catch {
-        return null;
-      }
-    })();
-    const apiUrl = process.env.DASHWISE_API_URL ?? cfg?.apiUrl ?? "http://localhost:3000";
-    let entry = readModuleEntry(manifestSlug);
+    if (entry && options.install !== void 0 && entry.installationId !== options.install) {
+      fail(
+        `No key for install #${options.install}: the cached ${code("dwk_")} key of ${code(manifestSlug)} belongs to install #${entry.installationId}. Nothing was run.`
+      );
+      return 1;
+    }
     if (cfg) {
       const healed = await resolveModuleApiKey(
         manifestSlug,
@@ -22644,11 +23562,26 @@ async function queryCommand(options) {
     }
     if (entry?.apiKey) {
       process.env.DASHWISE_API_KEY = entry.apiKey;
+      keySource = "cached";
       if (!process.env.DASHWISE_API_URL) {
         process.env.DASHWISE_API_URL = apiUrl;
       }
     }
   }
+  if (process.env.DASHWISE_API_KEY) {
+    const target = await nameKeyTarget({
+      apiKey: process.env.DASHWISE_API_KEY,
+      keySource,
+      entry,
+      cfg,
+      apiUrl: process.env.DASHWISE_API_URL ?? apiUrl,
+      ...options.install !== void 0 ? { install: options.install } : {}
+    });
+    if (target !== 0) return target;
+  } else if (options.install !== void 0) {
+    fail(`No ${code("dwk_")} key to check against install #${options.install}. Set ${code("DASHWISE_API_KEY")}. Nothing was run.`);
+    return 1;
+  }
   const modes = [
     options.inline !== void 0 ? "inline" : null,
     options.file !== void 0 ? "file" : null,
@@ -23014,7 +23947,7 @@ function formatTimestamp(iso) {
   return iso.slice(0, 19).replace("T", " ");
 }
 function sleep2(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 
 // src/commands/module/action-log.ts
@@ -23116,7 +24049,7 @@ async function runTail2(installationId, options) {
       }
       dim(`(tail: transient error \u2014 ${err.message})`);
     }
-    await new Promise((resolve15) => setTimeout(resolve15, POLL_INTERVAL_MS2));
+    await new Promise((resolve16) => setTimeout(resolve16, POLL_INTERVAL_MS2));
   }
 }
 function printTable(rows) {
@@ -23501,7 +24434,7 @@ async function sleep3(ms, aborted) {
   const slice = 100;
   let waited = 0;
   while (waited < ms && !aborted()) {
-    await new Promise((resolve15) => setTimeout(resolve15, Math.min(slice, ms - waited)));
+    await new Promise((resolve16) => setTimeout(resolve16, Math.min(slice, ms - waited)));
     waited += slice;
   }
 }
@@ -24332,12 +25265,29 @@ moduleCmd.command("list").description("List modules you own (or `--all` for owne
     ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
   });
 });
-moduleCmd.command("diff").description("Show what would change at the next publish vs the currently-published version.").option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit the structured diff as JSON instead of the human-readable summary.").action(async (cmdOpts) => {
-  process.exitCode = await moduleDiffCommand({
-    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
-    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
-  });
-});
+moduleCmd.command("diff").description(
+  "Show what would change at the next publish vs the currently-published version. With --check: exit 1 when module.json is not an additive evolution of the released manifest (a removed table or field, a retype, a removed or reordered option, a new unique index (`indexes[].unique`) over an existing field, a dropped unique index, required tightened, or a slug reused after an earlier removal), 2 on a usage or read error. Offline with --base."
+).option("--dir <path>", "Project root (default: current directory).").option("--json", "Emit the structured diff as JSON instead of the human-readable summary.").option("--check", "Check additive evolution against the released manifest (exit 0 additive, 1 not additive, 2 error).").option("--base <ref|path>", "With --check: the base manifest from a git ref (its module.json, history from its log) or, when the path exists, a file. Default: the released version on the platform.").option("--base-file <path>", "With --check: the base manifest from a file.").option("--head <path>", "With --check: the manifest to check (default: <dir>/module.json).").option("--no-history", "With --check: skip the slug-reuse scan of older versions.").option("--dry-run", "Accepted for uniformity; --check never writes anything.").action(
+  async (cmdOpts) => {
+    if (cmdOpts.check) {
+      const { moduleDiffCheckCommand: moduleDiffCheckCommand2 } = await Promise.resolve().then(() => (init_diff_check(), diff_check_exports));
+      process.exitCode = await moduleDiffCheckCommand2({
+        ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+        ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
+        ...cmdOpts.base !== void 0 ? { base: cmdOpts.base } : {},
+        ...cmdOpts.baseFile !== void 0 ? { baseFile: cmdOpts.baseFile } : {},
+        ...cmdOpts.head !== void 0 ? { head: cmdOpts.head } : {},
+        // commander maps `--no-history` to `history === false`.
+        ...cmdOpts.history === false ? { noHistory: true } : {}
+      });
+      return;
+    }
+    process.exitCode = await moduleDiffCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
 moduleCmd.command("pull-data").description("Export the module's own-table rows to a local JSON file (for fixtures, local dev seeding).").option("--dir <path>", "Project root (default: current directory).").option("--limit <n>", "Max rows per table (1-1000, default 100).", parseIntOption).option("--out <path>", "Output file path (default: ./dashwise-data.json).").action(async (cmdOpts) => {
   process.exitCode = await modulePullDataCommand({
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
@@ -24489,6 +25439,10 @@ program.command("query").description(
 ).option(
   "--stream",
   "Call .stream() instead of .execute() \u2014 prints rows incrementally as JSON-lines (one row per line). Lets you see progress on big queries + Ctrl-C cleanly midway. Mutually exclusive with --explain and --repl."
+).option(
+  "--install <id>",
+  "The install the key must belong to: reads that install's key list with your CLI login (one request, 1.5 s), prints `\u2192 install #<id> (key checked)` and refuses (exit 1) when DASHWISE_API_KEY is not an active key of that install or the list cannot be read.",
+  parseIntOption
 ).action(
   async (cmdOpts) => {
     process.exitCode = await queryCommand({
@@ -24498,16 +25452,22 @@ program.command("query").description(
       ...cmdOpts.repl !== void 0 ? { repl: cmdOpts.repl } : {},
       ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
       ...cmdOpts.explain !== void 0 ? { explain: cmdOpts.explain } : {},
-      ...cmdOpts.stream !== void 0 ? { stream: cmdOpts.stream } : {}
+      ...cmdOpts.stream !== void 0 ? { stream: cmdOpts.stream } : {},
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {}
     });
   }
 );
 program.command("run [cmd...]").description(
-  "Run a command with the module's Dashwise env injected \u2014 resolves DASHWISE_API_URL + DASHWISE_API_KEY through the same chain as `dashwise query` (explicit env \u2192 .env.local \u2192 the cached dwk_ key) and spawns the command with them overlaid, inheriting stdio and propagating the exit code. Example: `dashwise run -- node seed.mjs`."
-).option("--dir <path>", "Project root containing `module.json` (default: current directory).").action(async (cmdArgs, cmdOpts) => {
+  "Run a command with the module's Dashwise env injected \u2014 resolves DASHWISE_API_URL + DASHWISE_API_KEY through the same chain as `dashwise query` (explicit env \u2192 .env.local \u2192 the cached dwk_ key) and spawns the command with them overlaid, inheriting stdio and propagating the exit code. Names its target first (`\u2192 install #<id> (\u2026)`, at most one lookup request); `--install <id>` refuses a key of any other install. Example: `dashwise run --install 42 -- node seed.mjs`."
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option(
+  "--install <id>",
+  "The install the key must belong to. Reads that install's key list with your CLI login (one request, 1.5 s), prints `\u2192 install #<id> (key checked)` and refuses (exit 1, nothing run) when DASHWISE_API_KEY is not an active key of that install or the list cannot be read.",
+  parseIntOption
+).action(async (cmdArgs, cmdOpts) => {
   const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_run(), run_exports));
   process.exitCode = await runCommand2(cmdArgs ?? [], {
-    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {}
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {}
   });
 });
 program.command("pull").description(
@@ -24634,13 +25594,17 @@ envCmd.command("export").description(
 ).option(
   "--key <dwk_value>",
   "Use a previously-minted API key (paste plaintext). (Mutually exclusive with --new-key.)"
+).option(
+  "--with-secret-names",
+  "Also name each secret declared in module.json runtime.secrets[] as a commented `# KEY=` line (a comment naming the command for railway/vercel/fly; stderr for json). Never a value: values never leave Dashwise; set them on your host."
 ).action(
   async (cmdOpts) => {
     process.exitCode = await envExportCommand({
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
       ...cmdOpts.format !== void 0 ? { format: cmdOpts.format } : {},
       ...cmdOpts.newKey !== void 0 ? { newKey: cmdOpts.newKey } : {},
-      ...cmdOpts.key !== void 0 ? { key: cmdOpts.key } : {}
+      ...cmdOpts.key !== void 0 ? { key: cmdOpts.key } : {},
+      ...cmdOpts.withSecretNames ? { withSecretNames: true } : {}
     });
   }
 );
@@ -24666,7 +25630,10 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
 ).option(
   "--timeout <seconds>",
   "Max seconds to wait for an async build before giving up polling (default 360)."
-).option("--json", "Emit the final build result as machine-readable JSON.").action(
+).option("--json", "Emit the final build result as machine-readable JSON.").option(
+  "--strict",
+  "Refuse to publish when module.json is not an additive evolution of the released version (the `module diff --check` rules), or when that check cannot run. Without it the check only warns."
+).action(
   async (cmdOpts) => {
     const timeoutSec = cmdOpts.timeout !== void 0 ? Number(cmdOpts.timeout) : void 0;
     process.exitCode = await modulePublishCommand({
@@ -24682,19 +25649,23 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
       // commander maps `--no-wait` to `wait === false`.
       ...cmdOpts.wait === false ? { noWait: true } : {},
       ...timeoutSec !== void 0 && Number.isFinite(timeoutSec) ? { timeoutSec } : {},
-      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
+      ...cmdOpts.strict !== void 0 ? { strict: cmdOpts.strict } : {}
     });
   }
 );
-moduleCmd.command("install [slug]").alias("deploy").description(
-  'Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 "deployed, setup pending" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it.'
+moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description(
+  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently: an upgrade first prints what it does to the copy's data (tables and fields it moves to the Trash or converts, with their counts), asks once, and sends the preview's drift_hash. A move that loses data is accepted only by a person: the one question in a terminal, or --accept-data-loss <drift_hash> with the hash the preview printed. --yes never accepts data loss; with no terminal, or inside an AI agent session, a lossy move is refused and the refusal prints the re-run line. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 \"deployed, setup pending\" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it."
 ).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option("--force", "Proceed even when the upgrade breaks consumer modules (UPGRADE_BREAKS_CONSUMERS).").option(
   "--keep-dev-install",
   "Install production ALONGSIDE the workspace's kind=local dev install, leaving local dev working. Non-destructive. Backends >= 2026-07-15 keep a separate live-install slot per kind group, so the two coexist."
 ).option(
   "--replace-dev-install",
   "Destroy the workspace's kind=local dev install first, then fresh production install. Revokes the cached local-dev credentials; on backends >= 2026-07-15 local dev can be re-provisioned afterwards (dashwise module reset-dev-install, or dashwise init <slug> --workspace <ws>) and will coexist with the production install. On OLDER backends this is one-way \u2014 prefer --keep-dev-install."
-).option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option("--json", "Emit the final result as machine-readable JSON.").action(
+).option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use). Never accepts data loss: see --accept-data-loss.").option(
+  "--accept-data-loss <drift_hash>",
+  "Accept the data loss of this upgrade: the drift_hash its preview printed. Only that exact hash accepts it (a person decides; an agent stops and reports the hash)."
+).option("--json", "Emit the final result as machine-readable JSON.").action(
   async (slug, cmdOpts) => {
     process.exitCode = await moduleInstallCommand(slug, {
       ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
@@ -24704,6 +25675,7 @@ moduleCmd.command("install [slug]").alias("deploy").description(
       ...cmdOpts.replaceDevInstall !== void 0 ? { replaceDevInstall: cmdOpts.replaceDevInstall } : {},
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
       ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+      ...cmdOpts.acceptDataLoss !== void 0 ? { acceptDataLoss: cmdOpts.acceptDataLoss } : {},
       ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
     });
   }
@@ -25000,7 +25972,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.24.0";
+  return "0.26.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);
@@ -25016,6 +25988,7 @@ function collectRepeated(value, previous) {
 // src/bin.ts
 (async () => {
   try {
+    await installEnvProxy();
     await program.parseAsync(process.argv);
   } catch (err) {
     if (err instanceof ExcessArgumentsError) {